Social engineering

Phishing, pharming, shouldering and blagging, and a filter that flags them.

F11.3Cyber securityGCSE15 min

Do this lesson in the simulator

The easiest way past a lock is to get someone to open it for you. Social engineering is tricking people into giving away information or access, rather than attacking the technology. No firewall stops it, because the attacker never breaks in: they are let in. This lesson covers the common tricks and builds a filter that flags suspicious messages.

The tricks

Trick What happens
Phishing fake emails or messages, pretending to be a bank, a school or a friend, that ask you to click a link, log in, or send details
Pharming secretly sending you to a fake website even when you type the real address, to steal what you enter
Shouldering watching over someone's shoulder as they type a password or PIN
Blagging (pretexting) inventing a story to gain trust: "I'm from IT, I need your password to fix your account"
Baiting leaving an infected USB stick where someone will find it, plug it in, and be curious

Spotting a phishing message

Phishing messages usually share tells:

  • an urgent threat: "your account will be closed in 24 hours";
  • an unexpected request for a password, PIN or payment;
  • a link whose address is not the real website's;
  • poor spelling, or a greeting like "Dear Customer";
  • an address that is almost right but not quite: support@paypa1.com.

Real organisations do not ask for your password. When in doubt, do not click; go to the website yourself.

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

warning_signs = ["urgent", "verify your password", "click here", "you have won"]
message = "URGENT: verify your password now or your account is closed"
score = sum(1 for sign in warning_signs if sign in message.lower())
print("suspicious signs:", score)
print("phishing" if score >= 2 else "probably safe")

Run this in the simulator

Why it works

Social engineering plays on being helpful, being afraid, being curious, or being rushed. The defence is not technical: it is training, taking a moment to think, and having rules such as "IT will never ask for your password". People are the weakest link, so people are also the best defence.

Task: a phishing filter

Write score_message(message), which returns how many of the warning_signs appear in the message (ignoring capital letters). For each message in inbox, print <subject>: <score> and then, on the same line, PHISHING if the score is 2 or more. At the end print flagged <n> of <total>.

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

warning_signs = ["urgent", "password", "click here", "you have won", "verify", "gift card"]
inbox = [
    ("Lunch tomorrow?", "Are you free for lunch tomorrow?"),
    ("Account alert", "URGENT: verify your password by click here now"),
    ("You have won", "You have won a gift card, click here to claim"),
    ("Homework", "Here is the homework for Friday"),
]

Challenges

  1. Add a check for a web address that does not end in bugbotlab.com.
  2. Why is "Dear Customer" a warning sign, when "Dear Alex" is not?
  3. Someone rings claiming to be from IT and asks for your password. What do you do, and why?